Later, a contact he made at the telephone company in Ephrata told him that the switching machines were set up to print out a “trouble card” every time a call was made to a nonworking number. Before April 1961, his contact said, the nonworking information number in Alberta was getting about twenty calls a month from Barclay’s area of Washington. In April it went to fifty calls. After April it went up to about two hundred calls a month for the rest of the summer.
“They didn’t know where they were coming from,” he says, but they started investigating more seriously. By the middle of August investigators had tracked it down to Ephrata. By September 1 they apparently had zeroed in on the photographer’s studio.
That timing lined up with another thing, Barclay says. Sometime during the first week of September Barclay wanted to make a call using his blue box. He walked down the usually deserted back alley between the TV repair shop and the photography studio. “I remember, there was a black car that was parked in the alleyway with two guys that were just sitting there.” Barclay entered the photography studio and made his call. When he came back out, he says, “the car was still there, and the two guys were still sitting there. I thought that was strange that these people were just sitting in the alleyway.”
The vulnerability that Barclay had discovered with AT&T’s network stemmed from decisions that Bell Labs engineers had made in the 1930s and ’40s when they were designing the long-distance network. When they needed to find a way for their switching machines to communicate with each other, they decided to reuse the voice path that customers used to talk over. But this mixing of signaling and voice over the same channel carried with it a giant flaw: if you could hear the tones the machines were making, they could hear you. And that meant you could spoof them. All you had to do was mimic the tones they used.
Worse, AT&T had been deploying switching and signaling equipment based on this design since the 1940s. Now, twenty years later, there was a large installed base of equipment that had this hole in it. And this installed base was hardware, buildings full of machines and equipment and electronics. Today, when Microsoft finds a security flaw in its Windows operating system, it can push out a software patch and have things fixed relatively quickly. No such luck for AT&T’s switching equipment back in the day. Its “operating system” was electromechanical, and updating it would require physical changes, possibly redesigning and removing and replacing the equipment wholesale.
It was a flaw that would cost millions, possibly billions, of dollars to fix. It would be discovered again and again over the following twenty years. The question for AT&T was: what do we do about it?
Six
“Some People
Collect Stamps”
IT WAS A Sunday morning—the last Sunday morning in April 1959, as it happens—and something approximating a miracle had just occurred. At least it seemed that way to Charlie Pyne, a fifteen-year-old high school student in Marblehead, Massachusetts. A few months earlier, a man from the telephone company had come to his family’s house and replaced their telephones. The old phones had no dials. The new ones did: shiny black metal rotary dials.
The dials on the new phones didn’t do anything at first. You could spin them and they’d spin back, the phone making a clicking noise from its earpiece. And that was all. But things changed that Sunday morning. The night before, somewhere in the bowels of the telephone company, someone flipped the million-dollar switch that enabled the metal dials on the phones in Marblehead. Yesterday, Pyne would have had to lift the handset of the telephone and politely ask the operator to connect him with his buddy Rick a few blocks away. Today, he could dial Rick’s number himself: NEptune 1-1559.
To Pyne, this really was close to a miracle. The miracle part was because it was so cool not to have to deal with the operator. But it was only close to a miracle, because the dialing instructions from the phone company said that there were really only a handful of places you could call with these newfangled phones: Marblehead and three adjacent towns, Salem, Lynn, and Swampscott. That seemed lame. A real miracle would be if you could call anywhere with the new phones. That would be cool.
Charlie Pyne was a technical kid. Slightly heavy for his five-foot-nine frame, with respectably short brown hair and brown eyes, Pyne had been interested in electronics since a young age and had earned his ham radio license a few years earlier. He was no stranger to playing with things, to taking them apart, to seeing what they could do, to using them in ways that others hadn’t thought of. Pyne played around a bit with the new phone that Sunday morning, first dialing his friends and later just dialing numbers at random to see what would happen. When he dialed a nonworking number he’d get what the phone company called a crybaby: a loud tone that went up and down and sounded sort of like woo-ahh, woo-ahh.
Pyne found himself wondering about the new phone. Did every number other than those in Salem and Marblehead get you a crybaby? Or were there maybe some other places you could get to that the phone company hadn’t told them about?
If idle hands are the devil’s tools, then a clever teenager with idle hands and a methodical personality is the devil’s munitions factory. Pyne knew that the first three digits of a local telephone number were called the exchange and that there might be several exchanges in a city. He also knew that, for whatever reason, exchanges were never given the numbers 000 through 199. And he knew that exchange numbers didn’t have 0 or 1 as the second digit.
Out of one thousand three-digit numbers, that left 640 possible exchange codes. Pyne made a list. And then he started dialing, one number in every exchange. 220-1212. 221-1212. 222-1212. And on and on. He ended every number in 1212 because, for some reason he can’t explain, he found it easier than dialing 1111.
Pyne listened to a lot of crybabies—he was a persistent kid. On the ninety-second try, with a slightly sore index finger, something interesting happened. When he dialed 331-1212 he didn’t get a crybaby. Instead, a woman’s voice answered: “Boston.”
Pyne hung up.
He continued his dialing experiments over the coming weeks. He found a few other interesting exchanges. He also spent a lot of time playing with the 331 exchange, eventually dialing most of the numbers in it. It was a strange place, populated with special telephone operators and weird tones and odd clicky noises. 331-1312 went to a directory assistance operator, 331-1412 was answered by a woman who identified herself as “rate and route,” whatever that was, and 331-1020 gave a loud, continuous tone.
Pyne finally got up the courage to call back the operator who had answered the phone “Boston” at 331-1212. He asked her who she was. She said she was the Boston inward operator.
Pyne hung up again, having just learned a valuable lesson: you could know something’s name yet still have no idea what it was.
A few months later Pyne was at an electronics junk dealer in Salem called Young Engineering. While browsing the surplus electronics on the shelves, he met another teenager who was also looking for cheap bits of used electronics. Paul Heckel was a tall, heavyset kid with a slightly unkempt appearance, a ready smile, and a funny, high-pitched laugh. Oddly enough, Heckel and Pyne had both grown up in Marblehead; they had attended the same high school, in fact. Their paths hadn’t crossed until then because Heckel was a couple of years older than Pyne and was now off at MIT, majoring in electrical engineering.
They quickly became friends. Heckel took Pyne on a trip to see MIT’s new IBM 7090 computer and to check out Eli Heffron’s, the premier electronics surplus store in Cambridge. Pyne was soon telling Heckel about his dialing experiments. Heckel’s sister was a telephone operator and was able to fill in a bunch of details for Pyne, such as what an inward operator was and what a rate-and-route operator did and what they could do for you.
Before long Pyne, Heckel, Heckel’s sister, and Pyne’s buddy Rick Turner were in Pyne’s basement making calls via the Boston inward operator. Heckel’s sist
er was an asset to their games: in addition to her knowledge of the telephone system, she was a girl. For most fifteen-year-old boys, that might be reason enough, but Pyne realized that her female voice meant that calls she placed went through unquestioned. The boys learned that they had to pretend to be engineers working on the test board.
There was just one problem: they didn’t really have anyone to call. Indeed, most of their calls were to telephone company test numbers, to operators, or to one another. They were particularly proud of one call—so much so that they recorded it. It started with their old friend at 331-1212.
“Boston.”
“Milwaukee inward please,” said Turner.
Boston inward was suspicious that day. “Where are you calling from?” she asked, an edge in her voice.
“Marblehead test board,” Turner replied, his voice 100 percent bored telephone company engineer.
There was a pause as she put the call through. Click. The noise on the line got louder. Ring.
“Milwaukee,” said the distant operator.
“Milwaukee, this is Boston test board,” said Turner. “Could you put me through to Portland inward please? Portland, Oregon?”
“Portland, right.” Telephone company operators were trained to use the word right, much like military radio operators are trained to say roger.
Ten seconds went by. “Portland,” said the operator in Oregon.
Turner had the Portland operator connect him to the Denver inward. Then he had the Denver inward call Little Rock. At Little Rock he asked to be connected to New York. And when he got to the New York inward he asked for Boston.
“Boston.” The voice was buried in noise but the operator’s Boston accent was still recognizable.
“Could you get me a number in Marblehead, please? Neptune 1-9819.”
Ringing. “Hello.”
“Hello, Charles!”
Turner had successfully routed a call from Pyne’s house, across the country, and to a nearby pay phone—about 5,600 miles to go several hundred yards.
The junior and senior years of Pyne’s high school career were spent at Governor Dummer Academy, an elite boarding school with a funny name twenty-five miles north of his hometown. Pyne describes Governor Dummer as near-Dickensian. “We couldn’t go home on weekends,” he says, and “we had to say prayers before meals.” The worst part of being away at boarding school was being out of touch with his girlfriend Betsy. But thanks to 331, it didn’t have to be that way; he taught Betsy how to call him at school by pretending to be an operator. “I was soooo scared that someone was going to come and arrest me,” Betsy says. “I would go to a phone booth and put in my dime and dial 331-1212 . . .” Betsy would ask the operator to connect her to a pay phone in Pyne’s building. The use of a pay phone on Pyne’s end wasn’t a security measure as much as necessity; he simply didn’t have a phone in his room at school and a lobby pay phone was all that was available.
In 1962 Pyne left the confines of Governor Dummer and went on to enjoy the vast freedoms of Harvard University. That fall, Pyne made his way into the basement that housed Harvard’s student-run radio station. He was a radio geek, after all, so getting involved with the radio station seemed like a natural extracurricular activity. Pyne didn’t know it, but WHRB was much more than a radio station. As the journalist and alum Sam Smith wrote, “It also functioned as a counter-fraternity, a salon des refuses for all those who because of ethnicity, class or inclination did not fit the mold of Harvard. Other organizations sought students of the ‘right type,’ WHRB got what was left over. Eccentric WASP preppies, Brookline Jews, brilliant engineers, persons obsessed with a musical genre, addicts of show business or their own voices, seminal journalists, future entrepreneurs, prospective advertising executives, and persons of heretofore unrequited imagination and energy filtered through the door in the alley known as Dudley Gulch to become part of The Network.”
Pyne found a home in the WHRB engineering department. It was there that he met Tony Lauck, a sophomore, and Ed Ross, a junior. Similar to Pyne in build, Lauck had blue eyes and blond hair that was slightly longer and a bit unruly, as opposed to Ross who was thinner and taller but whose brown hair was already receding; a girlfriend of his predicted it would all be gone by the time he reached thirty. (“She was only about seventy percent right,” he says.) Pyne recalls being impressed by his new acquaintances: “They’re the type of guys that came into college with 1600 board scores and advanced placement.” And while he and Lauck were both ham radio operators and electronics tinkerers, Ed Ross was a music maven and mathematical prodigy who prided himself on not knowing anything about electronics. For example, to legally operate the radio transmitter at WHRB, you were supposed to have a first-class radiotelephone operator’s license—called a “first phone” license—issued by the Federal Communications Commission. The exam for this license was a rite of passage for electrical engineers back in the day, requiring a strong knowledge of electronics and radio theory. “Ed Ross didn’t even study. He went and took that test and passed it, just from the logic of the multiple choice questions,” Pyne says.
It wasn’t long before Pyne realized something: “These guys are going to be interested in telephone stuff.”
The campus telephone system was their gateway drug. Back in the day it was common for big organizations to connect their telephone switches via “tie lines,” that is, private trunk lines run between the different telephone systems. So, for example, if you dialed 83 on a Harvard telephone, you’d hear a pause and then a dial tone. You were now connected to MIT’s telephone system via the tie line, allowing you to dial an MIT extension. This allowed, say, a Harvard professor to easily reach a colleague at MIT—often at a lower cost. But if you were Pyne or Lauck or Ross, you saw a maze of twisty little telephone passages, all ripe with possibilities for exploration or prankery. Okay, dial 83 to get to MIT. Now what? What if we dial 83 here? Oh, look, that connected us back to Harvard! Hey, if we dial 83 repeatedly we can tie up all the lines between the two schools. Whee!
That was fun once. More interesting, though, was figuring out where else you could dial. The phones at WHRB provided the three convenient access to the campus telephone system. They spent lots of time dialing every code they could think of, just as Pyne had done several years earlier when he was exploring the telephone system in his hometown of Marblehead.
“From Harvard you could get a tie line to MIT, and from MIT there was one that went to Lincoln Labs, and from Lincoln Labs you could get to MITRE, and from MITRE you could get to IBM Kingston, and from IBM Kingston you could get to Stewart Air Force Base, and it went on and on, trying to put these connections together,” Pyne says. “This whole process was mainly for our fun and amusement. We weren’t too serious about making free phone calls or anything like that. It’s not like we had a lot of people we wanted to call.”
“The most useful technological discovery we made was that you should use a pencil for dialing, and not your finger,” Ross remembers. “After a couple of hours it is much less painful if you’re not putting your finger in the dial holes.”
Dialing around the tie-line system was addictive, like solving a never-ending chain of puzzles. First you had to figure out a code to get you somewhere. Then you had to figure out where that somewhere was. And then you had to figure out if there was anywhere interesting you could get to from there. And sometimes there were interesting places to visit that you couldn’t dial directly: lots of organizations had manual switchboard operators who could connect you to places you couldn’t get to with dialing. “If you dialed 0, you’d get the operator,” Pyne remembers. “Lots of times, you’d call the operator, you’d say, We’re testing, we’re doing this and that, can you tell me about your switchboard and what’s on your switchboard?” With a few white lies you could find out all the places she could connect you.
At the start of his freshman year, Pyne
had signed up for Fine Arts 13, Harvard’s introductory art appreciation class, also known as “Darkness at Noon” for its darkened room with dozing students and slide shows of classical artwork. Within a couple of weeks Pyne decided it was “the stupidest thing I ever signed up for.” His Fine Arts 13 notebook was unmolested, free of any writings except for the course title penned on its cover. It was quickly repurposed as the journal in which Pyne and his friends recorded their telephonic research; it would grow to more than a hundred pages.
They made a map, a diagram of circles and arrows, that showed who was connected to whom in the tie-line network. It wasn’t just schools; the map made clear the close ties among academia, industry, and the military of the period. Indeed, the label on the very first circle on the map said, in capital letters, nike control—the control center for the Nike missile air defense site in New England.
At one point during their map making Pyne found himself connected to the operator at Hanscom Air Force Base outside of Boston. He did his usual routine, making a bit of small talk and then asking her for the names of the other places she could reach from her switchboard. She obligingly recited a list of locations, ending with “. . . and Stewart and Rome,” in other words, Stewart Air Force Base and Rome Air Depot, both in New York.
Pyne misheard her. To him it sounded like she said “. . . and Stewart and Jerome.” Why would an air force operator have direct switchboard connections to two guys named Stewart and Jerome? How utterly random.
The names rapidly became a running gag among the group. “We started joking about Stewart and Jerome, these mythical characters,” Pyne says. “What are Stewart and Jerome doing today?” they’d ask each other. Ed Ross was particularly good at inventing Stewart and Jerome stories. “Oh, I talked to Jerome today,” he would say, followed by a detailed soliloquy regarding Jerome’s latest adventures.
Exploding the Phone : The Untold Story of the Teenagers and Outlaws Who Hacked Ma Bell (9780802193759) Page 8